Email address verification (safe or full SMTP probe)

mode: "safe" (default): syntax + DNS (MX, falling back to A/AAAA) + disposable/role heuristics. Never opens an SMTP connection. Rate-limited per key AND per account (an account holding multiple keys cannot multiply its effective ceiling), plus a service-wide concurrency cap.

mode: "full" is not generally available and returns 403 smtp_verify_disabled (or 403 verify_full_entitlement_required on a plan other than Business). When enabled it additionally opens one real SMTP session to the target domain's MX and issues a RCPT probe (never DATA) to check whether the specific mailbox exists. Separate, harder per-key/per-account rate limits and a separate small in-flight capacity pool apply on top of the safe-mode limits. SSRF-safe by construction: every resolved MX/A/AAAA address is validated as public before any connection is attempted; a domain that resolves exclusively to non-public addresses degrades to the safe verdict (smtp.probe: "skipped", reason: "mx_non_public") rather than erroring. Any probe failure (timeout, refused connection, per-domain cooldown, capacity exhaustion) degrades to 200 with the safe-mode verdict.